Linux Local Account Creation via useradd/adduser

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.